IPsec Security Policy Database Configuration MIB
Extracted elements (30)
Filters are implemented via a compound object (spdCompoundFilterTable + spdSubfiltersTable) rather than the IPCP's fixed condition/filter pairing. This provides greater flexibility for complex multi-criteria filters without IPCP's structural constraints and allows recursive nesting with no inherent depth limit.
IPsec- and IKE-specific actions are intentionally excluded from this base MIB and defined in companion documents (IPsec-ACTION and IKE-ACTION MIBs). This makes the base SPD MIB a general-purpose, extensible policy engine; companion action MIBs may impose additional constraints on objects in this MIB.
Policy tables use generic names (without 'SA', 'IPsec' prefixes) because packet classification and filter-to-action matching is more general than IPsec alone. The same tables can be reused for firewall configuration or other packet-transforming actions, avoiding protocol-specific lock-in.
The spdIpsoHeadFiltProtectionAuth enumeration uses 0 for genser, violating the SMIv2 convention of avoiding 0 in enumerated lists. This is intentional to preserve consistency with the authoritative RFC 1108 enumeration values.
This MIB is based on the IPsec model from RFC 2401, not RFC 4301 (which updated RFC 2401). Devices implementing RFC 4301 may encounter model differences when using this MIB for SPD configuration.
During packet processing, if spdGroupContFilter, spdRuleDefFilter, spdSubFiltSubfilter, or spdRuleDefAction references a non-existent or non-supported object, the packet MUST be dropped.
If an endpoint has been configured with a policy group and no rule within that group matches a packet, the default action SHALL be to drop the packet.
If no policy group has been assigned to an endpoint, the group specified by spdIngressPolicyGroupName MUST be used for inbound traffic and spdEgressPolicyGroupName MUST be used for outbound traffic through that endpoint.
In the SpdTimePeriod textual convention, the end date and time MUST be subsequent to the start date and time; setting the end earlier than or equal to the start SHOULD result in a wrongValue error.
Objects with SpdAdminStatus set to disabled MUST NOT be used by the packet processing engine. If a rule's spdRuleDefAdminStatus is disabled, processing MUST continue as if the rule's filter had effectively failed.
Rows within a policy group MUST be processed in ascending order of spdGroupContPriority. If an action executes as a result of processing a row, processing of further rows in that group MUST stop.
spdGroupContRowStatus MUST NOT be set to active until the row referenced by spdGroupContComponentName exists and is active. It MUST remain active unless no active spdEndpointToGroupTable row references its group or at least one other active row shares its spdGroupContName.
Sub-actions within a spdCompoundActionTable row MUST execute in series in ascending spdSubActPriority order. spdCompActExecutionStrategy governs whether to run all sub-actions (doAll), stop on first success (doUntilSuccess), or stop on first failure (doUntilFailure).
The spdIngressPolicyGroupName and spdEgressPolicyGroupName objects MUST be persistent across system reboots.
When a VariablePointer filter or action column is set to reference a non-existent row in a supported table, the inconsistentName exception MUST be returned; if the pointed-to table is unsupported entirely, an inconsistentValue exception MUST be returned.
spdCompoundActionTable (indexed by spdCompActName) combined with spdSubactionsTable (indexed by spdCompActName, spdSubActPriority) allows multiple ordered actions per rule. spdCompActExecutionStrategy controls execution: doAll(1), doUntilSuccess(2, default), or doUntilFailure(3).
spdCompoundFilterTable (indexed by spdCompFiltName) combined with spdSubfiltersTable (indexed by spdCompFiltName, spdSubFiltPriority) defines recursive boolean composite filters. spdCompFiltLogicType (AND/OR) determines evaluation semantics; each sub-filter may itself be a compound filter.
spdEndpointToGroupTable maps a policy group name (spdEndGroupName) to a specific interface (spdEndGroupInterface, indexed from IF-MIB ifIndex) and direction (spdEndGroupDirection: inbound or outbound), providing per-interface per-direction SPD assignment.
spdGroupContentsTable defines ordered policy groups where each row (indexed by spdGroupContName, spdGroupContPriority) references either a rule (spdRuleDefinitionTable) or a sub-group, as indicated by spdGroupContComponentType. An optional per-row spdGroupContFilter pre-screens the component.
spdIpOffsetFilterTable matches packets by comparing an administrator-specified OCTET STRING (spdIpOffFiltValue, SIZE 1..1024) against bytes at a byte offset (spdIpOffFiltOffset, 0..65535) from the front of the IP packet, using one of six comparison operators: equal, notEqual, arithmeticLess, arithmeticGreaterOrEqual, arithmeticGreater, arithmeticLessOrEqual.
spdIpsoHeaderFilterTable filters packets on IPSO (RFC 1108) security headers. spdIpsoHeadFiltType bits select which fields to check: classificationLevel (topSecret=61, secret=90, confidential=150, unclassified=171) and/or protectionAuthority (genser=0, siopesi=1, sci=2, nsa=3, doe=4).
spdRuleDefinitionTable binds a filter (spdRuleDefFilter, a VariablePointer) to an action (spdRuleDefAction, a VariablePointer) by name. The filter result may be negated via spdRuleDefFilterNegated (TruthValue) and the rule enabled or disabled via spdRuleDefAdminStatus (SpdAdminStatus).
spdTimeFilterTable enables time-based policy activation. Each row logically ANDs five conditions: spdTimeFiltPeriod (date range), spdTimeFiltMonthOfYearMask (12-bit BITS), spdTimeFiltDayOfMonthMask (64-bit octet string), spdTimeFiltDayOfWeekMask (7-bit BITS), and spdTimeFiltTimeOfDayMask (SpdTimePeriod).
spdTrueFilter is a read-only Integer32(1) scalar that always evaluates true, serving as a pass-all default filter. spdTrueFilterInstance (OID spdTrueFilter.0) is the canonical VariablePointer value used when no filtering is desired.
IANA assigned the IPSEC-SPD-MIB module the OID { mib-2 153 }, establishing the root of the spdMIB object tree. Sub-trees include spdConfigObjects (153.1), spdNotificationObjects (153.2), spdConformanceObjects (153.3), and spdActions (153.4).
Because this MIB directly controls which traffic receives IPsec protection, unauthorized write access can cause traffic to bypass security entirely. SNMPv3 with authentication (authNoPriv minimum) is required to protect against unauthenticated modifications to SPD policy.
Bootstrapping SPD configuration via SNMPv3 requires that SNMPv3 credentials be pre-provisioned before this MIB is usable. Operating with a default-drop SPD until SNMPv3 credentials are in place prevents policy exposure during initial provisioning.
SPD configuration may reveal sensitive network topology, classification levels, or protection authorities. SNMPv3 with privacy (authPriv) SHOULD be used to prevent involuntary disclosure of policy contents to passive observers.
spdTimeFiltDayOfMonthMask is an 8-octet (64-bit) OCTET STRING: bits 0-30 represent days 1-31 counted from the start of the month; bits 31-61 represent days 1-31 counted from the end of the month; bits 62-63 MUST be zero. Bits for non-existent days (e.g., day 29-31 in February) are ignored.
SpdTimePeriod is a UTF-8 OCTET STRING (SIZE 0..31) encoding a time range as 'yyyymmddThhmmss/yyyymmddThhmmss', where 'T' separates date from time and '/' separates start from end. The start may be replaced with 'THISANDPRIOR' and the end with 'THISANDFUTURE'.